Re: CAPTCHA image validation in web form

Nathan Andelin wrote:

That's a pretty good idea, but every file has a "signature", so to speak. A clever bot author wouldn't need to rely on a file name. And remember that a learning bot would be downloading and duplicating your entire image library and description cross-reference table, and could be assigning its own name to the image. It would just need to match up the signature. A signature might consist of a combination of factors such as total # of bytes, plus various byte comparisons interspersed throughout the stream.

That's a whole order of magnitude more difficult. It means actually reading and analyzing the image byte stream, rather than relying on the HTML for the link. I doubt anybody is doing that today, simply because it raises the amount of work significantly..

It's not that I have a better idea. I don't, but wish I did.

This is pretty simple, too, then. You'd have to use a servlet to serve the image, but then you could always tack a few bytes on the end of the image and/or change a random bit or two throughout the stream. Heck, you could completely change the colors with a replacement scheme. Have 256-color images and select the palette randomly, changing the bits in the image. Generate a new set of valid palettes every day to avoid colors that are too close.


But that's what I mean by diminishing returns. You can't stop the really persistent crime syndicates, but you can stop everybody else. If someone wants to invest hundreds of thousands of dollars in a grid computing system that analyzes and performs checksums on your images, then they will do so. But any of the things I suggest would stop 99.99% of the spammers, and that's what you really want.

Joe